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December 5, 2016 


VIA E-MAIL ONLY 

Attorney General George Jepsen 
Office of the Connecticut Attorney General 
55 Elm Street 
Hartford, CT 06106 
E-Mail: ag.breach@ct.gov 

Re: Supplemental Notice of Data Security Incident 

Dear Mr. Jepsen: 

We write to supplement the November 22, 2016 Notice of Data Security Incident (“November 22 
Notice”) submitted on behalf of Brennan Recupero Cascione Scungio and McAllister LLP 
(“Brennan Recupero”). By providing this supplemental notice, Brennan Recupero does not waive 
any rights or defenses regarding the applicability of Connecticut law or personal jurisdiction. 


Nature of the Cyber Security Incident 


As noted in the November 22 Notice, the process to identify the potentially affected population 
was time consuming and involved the work of third party forensic investigators, Brennan Recupero 
and the clients who provided the information involved to Brennan Recupero. After identifying the 
potentially affected individuals, Brennan Recupero determined that they lacked address 
information for many of the potentially affected individuals. Brennan Recupero worked with a 
third party to locate the needed address information for the potentially affected individuals so that 
Brennan Recupero could provide them with written notice. This process was recently completed 
and the additional address information showed that the personal information of 17,532 additional 
Connecticut residents were contained in files that was accessible to the unauthorized individual. 
The total number of potentially affected Connecticut residents is 17,553. Brennan Recupero 
currently believes that no additional Connecticut residents were potentially affected by this 
incident but will further supplement this notice should it become aware of any new significant 
facts subsequent to its submission. 
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On December 5, 2016, Brennan Recupero will be mailing a notice letter to the additional 
potentially affected Connecticut residents in substantially the same form as the letter attached here 
as Exhibit A. 


Contact Information 


Should you have any questions regarding this supplemental notification or other aspects of the 
cyber security incident, please contact me at (267) 930-4786. 


Very Truly Yours, 



Ryan C. Loughlin of 


MULLEN COUGHLIN LLC 


RCL:pah 
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EXHIBIT “A 



Brennan, Recupero, Cascione, Scungio & McAllister, LLP 
Attorneys At Law 

Processing Center • P.0. BOX 141578 • Austin, TX 78714 


03428 

JOHN Q. SAMPLE 
SESas 1234 MAIN STREET 
0,234 ANYTOWN US 12345-6789 


December 5, 2016 


RE: Notice of Data Breach 
Dear John Sample, 

Brennan Recupero Cascione Scungio and McAllister LLP (“Brennan Recupero”) recently discovered an incident that may 
affect the security of your personal information. We write to provide you with information about the incident, steps taken 
since discovering the incident, and information on what you can do to better protect against the possibility of identity theft 
and fraud. 

What Happened? On August 15, 2016, the credentials for a Brennan Recupero attorney were briefly used by an 
unauthorized individual to remotely access our computer network. The unauthorized access was quickly discovered and 
we immediately reset all user passwords to the network to prevent any further access to the network. In addition, we 
launched an internal investigation and retained third-party forensic experts to determine whether the unauthorized 
individual accessed any data within out network and if so, the extent of that access. 

What Information Was Involved? We determined that while the unauthorized individual or individuals had access to 
Brennan Recupero’s network, certain of your personal information was accessible and may have been viewed by the 
unauthorized individual including your name, Social Security number and address. 

What We Are Doing Brennan Recupero takes the security of your personal information very seriously. While we have 
no evidence your information was specifically impacted or that your information has been misused, we are offering you 
complimentary access to 24 months of free credit monitoring and identity restoration services with AllClear ID. The 
enclosed Steps You Can Take To Protect Against Identity Theft and Fraud contains instructions on how to enroll and 
receive these free services, as well as infonnation on what you can do to better protect against identity theft and fraud. 
We are also notifying certain state regulators of this incident. 

What You Can Do You can enroll to receive the free credit monitoring and identity restoration services. You can also 
review the enclosed Steps You Can Take to Protect Against Identity Theft and Fraud. 

For More Information You can call the call center we have set up for this incident at 1-855-804-2467. The call center 
is available Monday through Saturday, 9:00 a.m. to 9:00 p.m. E.S.T. 
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We take the privacy of your personal information seriously. We sincerely regret any inconvenience or concern this 
incident has caused you. The security of your information is a priority to us and we have taken precautionary measures to 
better prevent something like this from happening again. 


Sincerely, 

"7K. Scuncfia 

Benjamin M. Scungio 


(fa&cime 

Ronald F. Cascione 


Steps You Can Take to Protect Against Identity Theft and Fraud 


As an added precaution, we have arranged to have AllClear ID protect your identity for 24 months at no cost to you. The 
following identity protection services start on the date of this notice and you can use them at any time during the next 24 
months. 


AllClear Identity Repair: This service is automatically available to you with no enrollment required. If a problem arises, 
simply call 1-855-804-2467 and a dedicated investigator will help recover financial losses, restore your credit and make 
sure your identity is returned to its proper condition. 

AllClear Credit Monitoring: This service offers additional layers of protection including credit monitoring and a $1 
million identity theft insurance policy. For a child under 18 years old, AllClear ID ChildScan identifies acts of credit, 
criminal, medical or employment fraud against children by searching thousands of public databases for use of your child’s 
information. To use this service, you will need to provide your personal information to AllClear ID. 

You may sign up online at enroll.allclearid.com or by phone by calling 1-855-804-2467 using the following redemption 
code: Redemption Code. 

Please note: Additional steps may be required by you in order to activate your phone alerts and monitoring options. 

We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and 
to monitor your credit reports for suspicious activity. Under U.S. law you are entitled to one free credit report annually 
from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com 
or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of 
your credit report. 

At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts creditors to take 
additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors 
to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your 
identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. 
Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any 
one of the agencies listed below. 


Equifax 

P.O. Box 105069 
Atlanta, GA 30348 
800-525-6285 
www.equifax.com 


Experian 
P.O. Box 2002 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
800-680-7289 
www.transunion.com 


You may also place a security freeze on your credit reports. A security freeze prohibits a credit bureau from releasing any 
information from a consumer’s credit report without the consumer’s written authorization. However, please be advised 
that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any 
requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of 
identity theft, and you provide the credit bureau with a valid police report, it cannot charge you to place, list or remove a 
security freeze. In all other cases, a credit bureau may charge you a fee to place, temporarily lift, or permanently remove a 
security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed 
above if you wish to place a freeze on all of your credit files. To find out more on how to place a security freeze, you can 
use the following contact information: 


Equifax Security Freeze 

P.O. Box 105788 

Atlanta, GA 30348 

1-800-685-1111 

(NY residents please call 

1-800-349-9960) 

https://www.freeze.equifax.com 


Experian Security Freeze 
P.O. Box 9554 
Allen, TX 75013 
1-888-397-3742 

www.experian.com/freeze/center.html 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
1-888-909-8872 

www.transunion.com/securityfreeze 
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You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by 
contacting the Federal Trade Commission or your state Attorney General. For North Carolina residents, the Attorney 
General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For 
Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, 1- 
888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, 
Washington, DC 20580, www.identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The 
Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint 
with them. Instances of known or suspected identity theft should also be reported to law enforcement. This notice has not 
been delayed by law enforcement. Rhode Island residents: the Attorney General’s office can be contacted at 
http://www.riag.ri.gov/index.php, consumers@riag.ri.gov or (401) 274-4400. There were approximately 1102 Rhode 
Island residents affected by this incident. 


